AZL-103194

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103194.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-103194
Upstream
Published
2026-09-16T15:17:49Z
Modified
2026-09-19T14:16:11Z
Summary
CVE-2026-77407 affecting package keda 2.14.1-18
Details

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

References

Affected packages

Azure Linux:3 / keda

Package

Name
keda
Purl
pkg:rpm/azure-linux/keda

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.14.1-18

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103194.json"